Kendo UI for jQuery: Cross-site scripting in custom SVG icon sanitization
Summary
In Kendo UI for jQuery, the function sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can run JavaScript during icon creation, before the unsafe element is removed. The CVSS score is 7.1 (High); exploitation requires user interaction and a scope change.
Affected
- Kendo UI for jQuery 2026.3.1015 up to (excluding) 2026.4.1110 (per OffSeq and the CVE program; the vendor has not established the first affected release)
- Older versions: Unknown.
- Kendo UI Core (kendo-ui-core): Unknown.
Fixed in
- Upgrade to Kendo UI for jQuery 2026.4.1110 or later.
Workaround
- No vendor-stated workaround known.
- Until patched, do not pass custom icon markup from untrusted users or external sources into the icon feature.
- Consider a strict Content Security Policy as additional protection.
Exploitation
- Not known to be exploited in the wild (OffSeq). Not listed in CISA KEV at the time of research.
- Public proof of concept: Unknown.
Our recommendation
- Check whether any internal or customer web application uses Kendo UI for jQuery and whether it accepts custom icon content from users or external sources.
- Prioritise internet-facing and multi-user applications.
- Upgrade to 2026.4.1110 together with the other Kendo UI fixes from the same release (CVE-2026-124688, -124689, -124692, -124693).
- Ask your developers or software vendors for the upgrade status and monitor the vendor advisory and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik security advisory (KB) www.telerik.com
- OffSeq threat radar entry radar.offseq.com
- OpenCVE app.opencve.io
- CIRCL vulnerability recent list vulnerability.circl.lu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:22.
Original description (NVD)
In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.